c/cybersecurity-tips

My cheap password manager trick that actually fooled my coworkers

Found out the hard way after a break-in that my company's default password policy was garbage. Everyone used the same pattern. So I started using a weird method. I pick a random line from a book I'm reading, take the first letter of each word. Then I add the page number and a weird character I find on my keyboard. My boss watched me log in once and asked what I was doing. Laughed it off but nobody can guess my passwords now. They keep asking for my 'secret sauce' and I just say nope. Anyone else use something offbeat like this?

Got hit with a ransomware demand at my shop last Tuesday

Someone clicked a link in a fake "invoice overdue" email and locked up our customer database. I had to shut down the whole computer system for two days while I wiped drives and restored from a backup I keep on a disconnected hard drive. Lost about $3,000 in business because we couldn't look up parts or appointments. Anyone else keep an offline backup, or am I just paranoid?

Changed my mind about password managers after getting hit in July

I used to think password managers were just another thing to break or get hacked. Last July I had my email compromised because I reused a password from 2016. That login was on some random forum that got breached. Someone got into my email and tried resetting my bank password. It took me a full weekend to change everything. A friend at work kept telling me to try Bitwarden for months. Finally set it up in August and now I don't think I can go back. Has anyone else been stubborn about these things and then switched?

Got my LinkedIn account hacked after using a weak password at a coffee shop in Austin

I was at a Starbucks off Congress Avenue last Tuesday grabbing a latte and hopped on their free WiFi to check my LinkedIn messages. Didn't think twice about it since I always use the same basic password like 'password123' for everything. Next morning I got an email saying someone logged in from Brazil and started spamming my connections with crypto scams. Had to spend 3 hours resetting passwords and explaining to my old coworkers what happened. Anyone else been through this and found a password manager that actually works for them?

That moment I realized I was saving passwords in a text file for 4 years lol

I was showing my friend how I log into my bank account and he just stared at me when I opened Notepad with 50 passwords on it. Said I might as well write them on a sticky note on my monitor smh. Anyone else have that 'oh crap' moment with their password habits?

My password manager locked me out for 3 days

Last Tuesday I was updating my vault with new passwords for work and suddenly the master password I've used for 2 years just stopped working. Turns out the auto-update had a bug that corrupted my local database file. Anyone else ever had this happen and find a way to recover without losing everything?

Shoutout to the guy who told me to tape my webcam for real

I work remote for a company in Austin and my laptop camera light kept flickering green even when I wasn't in a meeting. Drove me nuts for like three months. Finally a buddy in IT said just cover it with a sticky note when you're not using it. I thought it was paranoid until I ran a quick scan and found a keylogger from a fake Zoom installer I clicked back in February. Now I keep a piece of black electrical tape over the lens at all times. Has anyone else caught something weird just from covering their camera?

Question about using a password manager after a close call

I almost got phished last month when a fake email pretended to be my bank. It looked so real that I nearly typed in my login info before I caught it. That got me thinking about password managers, since they'd auto-fill and probably warn me about sketchy sites. Has anyone else had a similar scare that pushed them to change their habits? I'm trying to figure out if a paid manager is worth it over the free options.

Switched from free VPN to a paid one after a rude wake-up call

I used to think all VPNs were basically the same so I just used a free one for like 2 years. Last week I ran a leak test on a whim after reading a post here and found out my real IP was showing through the whole time. The free one also logged my activity and sold it to ad companies which I only found out because I dug into their privacy policy for a school project. I switched to Mullvad which is 5 bucks a month and ran the same test with zero leaks. The speed difference is huge too like 80 Mbps vs the 20 I was getting before. Has anyone else here gotten burned by a free VPN or am I just the last person to learn this lesson?

Why do hotel business centers still use Windows 7?

Stayed at a Marriott near Newark last week and their business center PC was running Windows 7 with no antivirus. I just wanted to print a boarding pass, is anyone else finding ancient OS setups in public places?

Turned on 2FA after my Steam account got hijacked last month

I used to think two-factor authentication was just an extra hassle. I mean, who has time to grab their phone every time you log in to something? Then last month someone got into my Steam account and tried to buy $80 worth of skins using my linked PayPal. The only reason I caught it was because my bank texted me about the charge. Spent the next 3 hours on the phone with Steam support and my bank getting everything reversed. Now I have 2FA turned on for everything that offers it, my email, my bank, even my gaming accounts. The peace of mind is totally worth the extra 10 seconds. Has anyone else had a close call that finally made them lock things down?

My nephew's IT buddy told me I needed to update my router firmware or get hacked

He showed me on his laptop that my 3 year old router had 12 known security flaws and I changed the admin password and updated the firmware that same afternoon, anyone else ever ignore those update notifications?

Warning: Stop using "Password123" for your work accounts

I swear I caught 3 people in my office last week still using "Password123" for their login credentials even after we sent out a company-wide memo about it. It took me 15 minutes to explain why that's basically leaving the front door unlocked for hackers. Has anyone else had to fight this battle with coworkers?

Finally switched from LastPass to Bitwarden and wow what a difference

I used LastPass for like 4 years and just assumed all password managers had that clunky browser integration. Moved to Bitwarden last month and the autofill actually works every time. Has anyone else made the switch and noticed how much smoother it is?

The debate that keeps me up: is two-factor authentication a lifesaver or a trap?

I was at a coffee shop in Seattle about 3 months ago. Guy next to me, older dude, starts telling me his whole story. He said 'I lost access to my email because my phone broke and I couldn't get the 2FA code.' Took him 2 weeks to get back in. But on the other side, I've had friends who got their accounts hacked because they didn't have it on. So which is it really - are we safer with it or are we just adding another way to get locked out? Has anyone else had a nightmare situation with either approach?

Dropped $200 on a VPN subscription I never used

Signed up for a three year VPN deal back in 2021 thinking I'd use it for everything, but I forgot about it until the renewal notice hit my inbox last week. Turns out I didn't even log in once over those two years because my browser and phone already handle most of the privacy stuff. Anyone else sitting on a subscription they bought with good intentions but totally forgot about?

Spent 3 hours making a 'strong' password last week and my brother guessed it on try #2

I thought I was being clever using a line from my favorite obscure poem from 1987, but apparently he knew I was into that poet and just typed in the first stanza, so now I'm wondering if there's a secure way to pick passwords that aren't tied to your actual life history?

Hit 500 unique passwords in my manager today

I was just cleaning up old entries in my password manager and noticed it hit exactly 500 logins. That number surprised me because I only started keeping track a year ago when I got that breach alert from my email. Most of them are junk accounts I signed up for once, maybe 30 are actually important like banking and work stuff. How many do you guys have in yours, and do you bother deleting the old ones or just let them pile up?

Serious question: did that $200 password manager actually save you or just waste your money?

Last year I dropped $200 on a premium password manager bundle after seeing all the hype in forums. I had zero breaches and it felt safe, but my friend paid $40 for a basic one and got hit with a data leak anyway. Did your paid security tool ever prove its worth or did you just get lucky? I'm curious how many people here swear by the expensive stuff vs. the free options.

Almost got phished last week by a fake Amazon login page

Pro tip: my coworker told me to skip antivirus and I got hit with ransomware within a week

So I work remote for a small marketing firm in Austin. Last month my coworker Dave who's been in IT for like 20 years told me Windows Defender was all I needed and anything else was just bloatware eating up resources. I uninstalled my paid antivirus cause I trusted him. Next thing I know I clicked a link in an email that looked legit from a client and my whole system locked up with a message demanding $500 in Bitcoin. Had to wipe everything and lost 3 days of work on a campaign. Did I just get unlucky or should I stick with a paid antivirus moving forward?

Remember when 2FA meant getting a text message?

I started using online banking back in 2008 and two factor authentication was just a code sent to my flip phone. Now I've got like 6 different authenticator apps on my phone plus a hardware token for work. Last week I had to use 4 different methods just to log into my old PayPal account from 2010. Anyone else feel like security keeps getting more complicated instead of simpler?

Just realized I've been using the same password for 12 years on my email account

I only figured this out yesterday when my bank called me about suspicious login attempts from Nigeria. I've been using that same password since high school, no caps, no numbers, nothing. The guy on the phone actually laughed when I told him. Has anyone else been this dumb about their login habits?

Warning: That free Wi-Fi at the coffee shop almost got my bank account drained

Last Tuesday I was grabbing a latte at Brew House in downtown Austin and hopped on their free network. Three hours later I get a fraud alert from my bank about a $450 charge at a store I never been to. I realized the network had no password and anyone could have been sniffing traffic. Now I only use my phone hotspot at cafes and tell everyone I know to do the same. Has anyone else had a close call with public Wi-Fi?

Overheard a barista threaten to logout a customer's bank account

I was getting coffee yesterday and this guy at the next table was on the phone loudly arguing with his bank. He told the rep he'd 'just change the password when he felt like it.' The rep must have said something back because he yelled 'you can't force me to logout.' I almost choked on my latte. After I got home I checked my own online banking and realized I had sessions open on like 3 old devices. Did a full password reset and logged out everywhere else. Anybody else ever forget about old logins sitting around?